e91056d140d4b1f647fa92d6ddab5c986c8eb54f738f8c84ce0de009ba901580

Resubmissions

21/07/2024, 19:41

240721-yehdfs1epe 1

21/07/2024, 19:41

240721-yd3m1a1ene 7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

icons/icon-98x98-padded.png
Size

12KB
MD5

7ffdea687e222692b348a0326d777f8d
SHA1

dc839c9002c774f425eb521b3f3b7036777f3b00
SHA256

16ece6640430d4b164ac44b18f3d92b445c03456806250c56932399f10cdba92
SHA512

21d68fbbb3dda52aac61fc50d6eeb5816cc657551bdb588eb16c555de09ef7251b5fdf26336ed77cd09cd55c4de8ac5d5170e8c1d4c7772ad70207b13791aa7c
SSDEEP

192:l50uhhDsuWaAbf4oxRfZoPGDsrxpW+AkqzbE/FrTHs2zwIxLaT:zPXArnjRoPGDULSI/pTH/TS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\icons\icon-98x98-padded.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/2584-1-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download